424 matches found
phpMyAdmin < 2.5.6-rc1: possible attack against export.php
Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL databased over the Web. Description One component of the phpMyAdmin software package export.php does not properly verify input that is passed to it from a remote user. Since the input is used to include...
HP-UX B11.11 /usr/bin/ct Local Format String Root Exploit
Exploit for hp-ux platform in category local exploits ========================================================= HP-UX B11.11 /usr/bin/ct Local Format String Root Exploit ========================================================= / File : xhp-ux11inlsct.c Usage : cc xhp-ux11inlsct.c -o xct ; ./xct...
PHPWebFileManager 2.0 - index.php Directory Traversal
PHPWebFileManager 2.0 - index.php Directory Traversal source: https://www.securityfocus.com/bid/9053/info It has been reported that phpWebFileManager may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself d...
Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting
source: https://www.securityfocus.com/bid/9798/info A vulnerability has been reported in Microsoft Internet Explorer that could enable unauthorized access by malicious scripts and Active Content to document properties across different Security Zones and foreign domains. This issue is exposed when...
Directory Traversal in Sun iPlanet Administration Server 5.1
Text of original posting to Sun: Originator: EDS Information Assurance Group - Jim Hardisty, Mark Brewis Date of Contact: 22nd April 2003 Issue:During a recent Penetration Test, a member of the team, Jim Hardisty, identified an issue with an installation of iPlanet Administration Express. It is...
PHP-Proxima - autohtml.php Information Disclosure
PHP-Proxima - autohtml.php Information Disclosure source: https://www.securityfocus.com/bid/7598/info A vulnerability has been reported for PHP-Proxima. The problem occurs in the autohtml.php script. Specifically, the script fails to verify the contents of a user-supplied variable before includin...
CVE-2003-0258
Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 3.5.x through 4.0.REL, when enabling IPSec over TCP for a port on the concentrator, allow remote attackers to reach the private network without authentication...
Cisco Catalyst Enable Access Authentication Bypass (CSCea42030)
The remote Catalyst is affected by a password bypass vulnerability. Basically, an attacker who has a command line access may gain the 'enable' privileges without having to know the right password, which would allow him to reconfigure this host remotely. This vulnerability is documented with the...
Kebi Academy Home Page Administration file Parameter Traversal Arbitrary File Access
Kebi Academy, a Korean web application, fails to sanitize user input to the 'file' parameter to the 'home' script of directory traversal sequences. A remote attacker can leverage this issue to read arbitrary files or even upload arbitrary code to the affected host, to be executed subject to the...
GLIBC locale - Format Strings
/ su.c by xp, modified by logikal@efnet - tested on redhat 5 - 7 / include include include include include include include include char shellcode = "\x31\xc0\x83\xc0\x17\x31\xdb\xcd\x80\xeb" "\x30\x5f\x31\xc9\x88\x4f\x17\x88\x4f\x1a" "\x8d\x5f\x10\x89\x1f\x8d\x47\x18\x89\x47"...
Windows FTP Server NULL Administrator Password
The remote server is incorrectly configured with a NULL password for the user 'Administrator' and has FTP enabled. This script was written by Keith Young See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title 2/04/2009 include"compat.inc"; ifdescription scriptid1116...
CVE-2002-1150
The Remote Desktop Sharing RDS Screen Saver Protection capability for Microsoft NetMeeting 3.01 through SP2 4.4.3396 allows attackers with physical access to hijack remote sessions by entering certain logoff or shutdown sequences such as CTRL-ALT-DEL and canceling out of the resulting user...
CVE-2002-0051
Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access...
CVE-1999-1400
The Economist screen saver 1999 with the "Password Protected" option enabled allows users with physical access to the machine to bypass the screen saver and read files by running Internet Explorer while the screen is still locked...
Security Bulletin MS01-047
---------------------------------------------------------------------- Title: OWA Function Allows Unauthenticated User to Enumerate Global Address List Date: 06 September 2001 Software: Exchange 5.5 Impact: Information Disclosure Bulletin: MS01-047 Microsoft encourages customers to review the...
Удаленный root в Solaris через sadmind
No description provided...
Solaris/SPARC 2.7 lpset exploit (well not likely !)
Hi, lpset seems to use strcat to pass the argument for -r flag /usr/lib/print/lib/../../../../tmp/foo and appends .so to the end. in this case /tmp/foo.so is going to be dlopen but there is a special case /usr/lib/print/lib directory has to exist. xploit shell script is attached. $ uname -a SunOS...
CVE-2000-0208
The htdig ht://Dig CGI program htsearch allows remote attackers to read arbitrary files by enclosing the file name with backticks in parameters to htsearch...
EUVD-1999-0549
The registry in Windows NT can be accessed remotely by users who are not administrators...
ms.odbc.coldfusion.txt
Date: Tue, 1 Jun 1999 11:45:35 -0700 From: [email protected] To: [email protected] Subject: New Allaire Security Bulletin ASB99-09 Dear Allaire Customer -- We have recently become aware of a serious security vulnerability that may affect customers using Microsoft Access with ColdFusion...